GCP Workload Identity (Keyless)

About Google Cloud and GKE

You can connect Google Cloud to OX using Workload Identity Federation to scan and monitor your Google Cloud resources without creating or maintaining a long-lived service account key.

You can connect a single Google Cloud project or an entire Google Cloud organization. Both options use Workload Identity Federation. If you use Google Kubernetes Engine (GKE), you can also connect your GKE clusters after configuring the GCP connection.

Complete the Google Cloud configuration from Cloud Shell or a local shell using gcloud, and then complete the connection in OX.

Choose a connection scope

Choose the connection scope based on the Google Cloud resources that you want OX to access.

Connection scope	Description
Single project	Connect the resources of one Google Cloud project. The required roles are granted to the service account for that project.
Entire organization	Connect every project under a Google Cloud organization. The required roles are granted once at the organization level and inherited by the projects.

Roles granted to OX

OX uses nine read-only Google Cloud roles to access the resources required for scanning. These roles define the extent of OX's access to your Google Cloud resources.

Role ID	Description
roles/viewer	Provides baseline read access to project resources.
roles/iam.securityReviewer	Provides read access to IAM policies and security configuration.
roles/storage.objectViewer	Provides read access to Cloud Storage object metadata and contents.
roles/accessapproval.viewer	Provides read access to Access Approval settings.
roles/accesscontextmanager.policyReader	Provides read access to VPC Service Controls policies.
roles/discoveryengine.viewer	Provides read access to Vertex AI Search and Discovery Engine resources.
roles/firebaserules.viewer	Provides read access to Firebase security rules.
roles/firebase.viewer	Provides read access to Firebase project configuration.
roles/healthcare.datasetViewer	Provides read access to Healthcare API dataset metadata.

Troubleshooting

Issue	Resolution
Policy modification fails when you run gcloud alpha iam policies lint-condition.	Retry the binding. Concurrent policy writes are the usual cause. Run the command again with --verbosity=debug and look for setIamPolicy ... 200, which indicates that the policy was applied. If the issue continues, check for a domain-restricted-sharing constraint.
PERMISSION_DENIED when you run gcloud organizations add-iam-policy-binding.	Organization-level bindings require roles/resourcemanager.organizationAdmin. A user with this role in your organization must perform the organization-level role assignment.
PERMISSION_DENIED when you run gcloud services enable.	Grant roles/serviceusage.serviceUsageAdmin at the organization level to the user performing the configuration.
Individual projects fail during API enablement.	Projects with billing disabled are expected to fail and remain out of scope. The API enablement loop prints a check for each project and continues processing the remaining projects. After resolving the issue for a project that you want OX to scan, run the API enablement step again.
OX discovers fewer projects than expected.	Verify that cloudresourcemanager.googleapis.com is enabled in each project and that the required organization-level role bindings are configured. OX uses Cloud Resource Manager to discover projects.
gcloud projects list doesn't return any projects.	Sign in again using gcloud auth login and verify that your account has the resourcemanager.projects.list permission.